10 April, 2016

How to hack an election

Andrés
Sepúlveda rigged elections throughout Latin America for almost a
decade. He tells his story for the first time.

PART 2

Sepúlveda
grew up poor in Bucaramanga, eight hours north of Bogotá by car. His
mother was a secretary. His father was an activist, helping farmers
find better crops to grow than coca plants, and the family moved
constantly because of death threats from drug traffickers. His
parents divorced, and by the age of 15, after failing school, he went
to live with his father in Bogotá and used a computer for the first
time. He later enrolled in a local technology school and, through a
friend there, learned to code.

In 2005,
Sepúlveda’s older brother, a publicist, was helping with the
congressional campaigns of a party aligned with then-Colombian
President Alvaro Uribe. Uribe was a hero of the brothers, a U.S. ally
who strengthened the military to fight the Revolutionary Armed Forces
of Colombia (FARC). During a visit to party headquarters, Sepúlveda
took out his laptop and began scanning the office’s wireless
network. He easily tapped into the computer of Rendón, the party’s
strategist, and downloaded Uribe’s work schedule and upcoming
speeches. Sepúlveda says Rendón was furious—then hired him on the
spot. Rendón says this never happened.

For decades,
Latin American elections were rigged, not won, and the methods were
pretty straightforward. Local fixers would hand out everything from
small appliances to cash in exchange for votes. But in the 1990s,
electoral reforms swept the region. Voters were issued tamper-proof
ID cards, and nonpartisan institutes ran the elections in several
countries. The modern campaign, at least a version North Americans
might recognize, had arrived in Latin America.

Rendón had
already begun a successful career based partly, according to his
critics—and more than one lawsuit—on a mastery of dirty tricks
and rumormongering. (In 2014, El Salvador’s then-President Carlos
Mauricio Funes accused Rendón of orchestrating dirty war campaigns
throughout Latin America. Rendón sued in Florida for defamation, but
the court dismissed the case on the grounds that Funes couldn’t be
sued for his official acts.) The son of democracy activists, he
studied psychology and worked in advertising before advising
presidential candidates in his native Venezuela. After accusing
then-President Chávez of vote rigging in 2004, he left and never
went back.

Sepúlveda’s
first hacking job, he says, was breaking into an Uribe rival’s
website, stealing a database of e-mail addresses, and spamming the
accounts with disinformation. He was paid $15,000 in cash for a
month’s work, five times as much as he made in his previous job
designing websites.

Sepúlveda
was dazzled by Rendón, who owned a fleet of luxury cars, wore big
flashy watches, and spent thousands on tailored coats. Like
Sepúlveda, he was a perfectionist. His staff was expected to arrive
early and work late. “I was very young,” Sepúlveda says. “I
did what I liked, I was paid well and traveled. It was the perfect
job.” But more than anything, their right-wing politics aligned.
Sepúlveda says he saw Rendón as a genius and a mentor. A devout
Buddhist and practitioner of martial arts, according to his own
website, Rendón cultivated an image of mystery and menace, wearing
only all-black in public, including the occasional samurai robe. On
his website he calls himself the political consultant who is the
“best paid, feared the most, attacked the most, and also the most
demanded and most efficient.” Sepúlveda would have a hand in that.

Rendón,
says Sepúlveda, saw that hackers could be completely integrated into
a modern political operation, running attack ads, researching the
opposition, and finding ways to suppress a foe’s turnout. As for
Sepúlveda, his insight was to understand that voters trusted what
they thought were spontaneous expressions of real people on social
media more than they did experts on television and in newspapers. He
knew that accounts could be faked and social media trends fabricated,
all relatively cheaply. He wrote a software program, now called
Social Media Predator, to manage and direct a virtual army of fake
Twitter accounts. The software let him quickly change names, profile
pictures, and biographies to fit any need. Eventually, he discovered,
he could manipulate the public debate as easily as moving pieces on a
chessboard—or, as he puts it, “When I realized that people
believe what the Internet says more than reality, I discovered that I
had the power to make people believe almost anything.”